Procedure examples

Skidmap has checked for the existence of specific files including /usr/sbin/setenforce and /etc/selinux/config. It also has the ability to monitor the cryptocurrency miner file and process.

Okrum has used DriveLetterView to enumerate drive information.

Conti can discover files on a local system.

SameCoin can list all system files and can avoid wiping specific directories such as Program Files, Windows, and Users.

Raspberry Robin will check to see if the initial executing script is located on the user's Desktop as an anti-analysis check.

Mispadu searches for various filesystem paths to determine what banking applications are installed on the victim’s machine.

Megazord can ignore specified directories for encryption.

Diavol has a command to traverse the files and directories in a given path.

Doki has resolved the path of a process PID to use as a script argument.

Siloscape searches for the Kubernetes config file and other related files using a regular expression.

BlackCat can enumerate files for encryption.

Fysbis has the ability to search for files.

MarkiRAT can look for files carrying specific extensions such as: .rtf, .doc, .docx, .xls, .xlsx, .ppt, .pptx, .pps, .ppsx, .txt, .gpg, .pkr, .kdbx, .key, and .jpb.

Kazuar finds a specified directory, lists the files and metadata about those files.

NETEAGLE allows adversaries to enumerate and modify the infected host's file system. It supports searching for directories, creating directories, listing directory contents, reading and writing to files, retrieving file attributes, and retrieving volume information.

POORAIM can conduct file browsing.

CHIMNEYSWEEP has the ability to enumerate directories for files that match a set list.

FatDuke can enumerate directories on target machines.

BlackEnergy gathers a list of installed apps from the uninstall program Registry. It also gathers registered mail, browser, and instant messaging clients from the Registry. BlackEnergy has searched for given file types.

zwShell can browse the file system.

Rising Sun can enumerate information about files from the infected system, including file size, attributes, creation time, last access time, and write time. Rising Sun can enumerate the compilation timestamp of Windows executable files.

NotPetya searches for files ending with dozens of different file extensions prior to encryption.

ShimRat can list directories.

ObliqueRAT has the ability to recursively enumerate files on an infected endpoint.

SHOTPUT has a command to obtain a directory listing.

Avaddon has searched for specific files prior to encryption.

XAgentOSX contains the readFiles function to return a detailed listing (sometimes recursive) of a specified directory. XAgentOSX contains the showBackupIosFolder function to check for IOS device backups by running ls -la ~/Library/Application\ Support/MobileSync/Backup/.

China Chopper's server component can list directory contents.

LightSpy uses the `NSFileManager` to move, create and delete files. LightSpy can also use the assembly `bt` instruction to determine a file's executable permissions.

Cheerscrypt can search for log and VMware-related files with .log, .vmdk, .vmem, .vswp, and .vmsn extensions.

KeyBoy has a command to launch a file browser or explorer on the system.

MiniDuke can enumerate local drives.

Pteranodon identifies files matching certain file extension and copies them to subdirectories it created.

BeaverTail has searched for .ldb and .log files stored in browser extension directories for collection and exfiltration.

ROKRAT has the ability to gather a list of files and directories on the infected system.

Babuk has the ability to enumerate files on a targeted system.

Exbyte enumerates all document files on an infected machine, then creates a summary of these items including filename and directory location prior to exfiltration to cloud hosting services.

DarkWatchman has the ability to enumerate file and folder names.

BlackMould has the ability to find files on the targeted system.

PACEMAKER can parse `/proc/"process_name"/cmdline` to look for the string `dswsd` within the command line.

BBSRAT can list file and directory information.

PlugX has a module to enumerate drives and find files recursively. PlugX has also checked the path from which it is running for specific parameters prior to execution.

Bisonal can retrieve a file listing from the system.

MultiLayer Wiper generates a list of all files and paths on the fixed drives of an infected system, enumerating all files on the system except specific folders defined in a hardcoded list.

DustySky scans the victim for files that contain certain keywords and document types including PDF, DOC, DOCX, XLS, and XLSX, from a list that is obtained from the C2 as a text file. It can also identify logical drives for the infected machine.

Remsec is capable of listing contents of folders on the victim. Remsec also searches for custom network encryption software on victims.

Rover automatically searches for files on local drives based on a predefined list of file extensions.

Epic recursively searches for all .doc files on the system and collects a directory listing of the Desktop, %TEMP%, and %WINDOWS%\Temp directories.

Peppy can identify specific files for exfiltration.

Cuba can enumerate files by using a variety of functions.